wtfsayo/secret-guard

v1.0.0MIT

Plugin for CLI agents — credential leak prevention via PreToolUse + PostToolUse hooks that block secret-leaking commands (cat .env, op --reveal, aws secretsmanager, gh auth token, kubectl secrets) and warn on output that already leaked. Works with Droid, Devin, Claude Code, opencode, Grok, Cursor, Codex, and omp.

GitHub

secret-guard

Keep secret values out of agent sessions. Applies whenever the agent handles credentials — API keys, passwords, tokens, connection strings, webhook signing secrets, 1Password/AWS-secrets-manager/cloud vault retrieval, or any file that may contain secrets (.env, credentials.json, ~/.ssh, ~/.aws, ~/.netrc, ~/.zshrc/history, MCP config).